feat: native app sign-in and push backend

.dockerignore

@@ -55,3 +55,6 @@ prisma/seed.ts
 
 creds
 package-lock.json
+
+# React Native app, built separately
+mobile

.env.example

@@ -50,6 +50,14 @@ AUTHENTIK_ID=
 AUTHENTIK_SECRET=
 AUTHENTIK_ISSUER=
 
+# Sign in with Apple in the native app. APPLE_BUNDLE_ID is the app's bundle id.
+# The key (Certificates, Identifiers & Profiles > Keys, with Sign in with Apple enabled) revokes a
+# user's Apple sign-in when they delete their account. Paste the .p8 contents, \n for newlines.
+APPLE_BUNDLE_ID=
+APPLE_TEAM_ID=
+APPLE_KEY_ID=
+APPLE_PRIVATE_KEY=
+
 # Storage: any S3 compatible storage will work, for self hosting can use minio
 # If you're using minio for dev, you can generate access keys from the console http://localhost:9001/access-keys/new-account
 # R2_ACCESS_KEY="access-key"

.eslintrc.cjs

@@ -4,6 +4,7 @@ const config = {
   parserOptions: {
     project: true,
   },
+  ignorePatterns: ["mobile/"],
   plugins: ["@typescript-eslint"],
   extends: [
     "next/core-web-vitals",

.prettierignore

@@ -0,0 +1,2 @@
+# React Native app, formatted with its own config (mobile/.prettierrc.json)
+mobile/

package.json

@@ -55,9 +55,11 @@
     "clsx": "^2.1.0",
     "cmdk": "^0.2.0",
     "date-fns": "^3.3.1",
+    "expo-server-sdk": "^7.2.0",
     "framer-motion": "^11.0.3",
     "geist": "^1.7.2",
     "input-otp": "^1.2.3",
+    "jose": "^6",
     "lucide-react": "^0.312.0",
     "marked": "^18.1.0",
     "nanoid": "^5.1.16",

prisma/migrations/20261021021229_add_device_push_token/migration.sql

@@ -0,0 +1,28 @@
+-- CreateTable
+CREATE TABLE "DevicePushToken" (
+    "id" SERIAL NOT NULL,
+    "userId" INTEGER NOT NULL,
+    "token" TEXT NOT NULL,
+    "platform" TEXT NOT NULL,
+    "deviceName" TEXT,
+    "sessionId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "DevicePushToken_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "DevicePushToken_token_key" ON "DevicePushToken"("token");
+
+-- CreateIndex
+CREATE INDEX "DevicePushToken_userId_idx" ON "DevicePushToken"("userId");
+
+-- CreateIndex
+CREATE INDEX "DevicePushToken_sessionId_idx" ON "DevicePushToken"("sessionId");
+
+-- AddForeignKey
+ALTER TABLE "DevicePushToken" ADD CONSTRAINT "DevicePushToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "DevicePushToken" ADD CONSTRAINT "DevicePushToken_sessionId_fkey" FOREIGN KEY ("sessionId") REFERENCES "Session"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/migrations/20261021120000_add_user_deleted_at/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "User" ADD COLUMN     "deletedAt" TIMESTAMP(3);

prisma/schema.prisma

@@ -35,11 +35,12 @@ model Account {
 }
 
 model Session {
-    id           String   @id @default(cuid())
-    sessionToken String   @unique
-    userId       Int
-    expires      DateTime
-    user         User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+    id               String            @id @default(cuid())
+    sessionToken     String            @unique
+    userId           Int
+    expires          DateTime
+    user             User              @relation(fields: [userId], references: [id], onDelete: Cascade)
+    devicePushTokens DevicePushToken[]
 }
 
 model User {
@@ -49,6 +50,9 @@ model User {
     emailVerified       DateTime?
     image               String?
     currency            String               @default("USD")
+    /// Set when the person deleted their account. The row stays, without their name or email, so
+    /// expenses and balances they share with others stay intact.
+    deletedAt           DateTime?
     accounts            Account[]
     sessions            Session[]
     groups              Group[]              @relation("GroupCreatedBy")
@@ -67,6 +71,7 @@ model User {
     friendships         Friendship[]         @relation("UserFriendships")
     friendOf            Friendship[]         @relation("FriendFriendships")
     recurringExpenses   RecurringExpense[]
+    devicePushTokens    DevicePushToken[]
 }
 
 model VerificationToken {
@@ -309,6 +314,25 @@ model PushNotification {
     subscription String
 }
 
+/// Expo push tokens of the native app, one per installation.
+model DevicePushToken {
+    id         Int      @id @default(autoincrement())
+    userId     Int
+    token      String   @unique
+    /// `ios` or `android`
+    platform   String
+    deviceName String?
+    /// The app session that registered it, so the token goes when that session ends
+    sessionId  String?
+    createdAt  DateTime @default(now())
+    updatedAt  DateTime @updatedAt
+    user       User     @relation(fields: [userId], references: [id], onDelete: Cascade)
+    session    Session? @relation(fields: [sessionId], references: [id], onDelete: Cascade)
+
+    @@index([userId])
+    @@index([sessionId])
+}
+
 model RateLimit {
     key         String   @id
     count       Int